codex-overleaf-link 2.5.0 → 2.6.0

package/extension/src/content/activeTurnControl.js

@@ -7,12 +7,23 @@
 })(typeof window !== 'undefined' ? window : globalThis, function activeTurnControlFactory() {
   'use strict';
 
+  // Startup has an owner before a Native request exists. This identity is only
+  // for ownership probes; nativeRequestId remains reserved for the actual RPC.
+  function getStartupRequestId(sessionId, runId) {
+    return `startup:${encodeURIComponent(sessionId)}:${encodeURIComponent(runId)}`;
+  }
+
   function create(options = {}) {
     const runtime = options.chrome?.runtime;
     let port = null;
     let binding = null;
     let reconnectTimer = null;
     let destroyed = false;
+    let bindingWaiter = null;
+    let bindingSequence = 0;
+    let recoveryTimer = null;
+    let recoveryGeneration = 0;
+    const inventoryRetries = new Map();
 
     function connect() {
       if (destroyed || port || typeof runtime?.connect !== 'function') {
@@ -21,6 +32,11 @@
       try {
         const nextPort = runtime.connect({ name: 'codex-overleaf/run-owner' });
         port = nextPort;
+        nextPort.onMessage?.addListener?.(message => {
+          if (port !== nextPort || message?.type !== 'bound' || !bindingWaiter || !binding) return;
+          if (['requestId', 'projectKey', 'clientRunId', 'sessionId'].every(key => message[key] === binding[key])
+            && message.browserOnly === true && message.ownerToken === binding.ownerToken) bindingWaiter(message.ok !== false);
+        });
         nextPort.onDisconnect?.addListener?.(() => {
           if (port === nextPort) {
             port = null;
@@ -46,20 +62,39 @@
     }
 
     function bind(value = {}) {
+      bindingWaiter?.(false);
       binding = {
         requestId: String(value.requestId || ''),
         projectKey: String(value.projectKey || ''),
         clientRunId: String(value.clientRunId || ''),
-        sessionId: String(value.sessionId || '')
+        sessionId: String(value.sessionId || ''),
+        ...(value.browserOnly === true ? { browserOnly: true, ownerToken: String(value.ownerToken || `browser-${++bindingSequence}`) } : {})
       };
       connect();
       postBinding('bind', binding);
     }
 
-    function release(requestId) {
-      if (!binding || (requestId && binding.requestId !== requestId)) {
+    async function bindBrowserRun(value) {
+      bind({ ...value, browserOnly: true });
+      if (destroyed || !port) return false;
+      return new Promise(resolve => {
+        const timeout = setTimeout(() => complete(false), 5000);
+        const complete = ok => {
+          clearTimeout(timeout);
+          if (bindingWaiter === complete) bindingWaiter = null;
+          resolve(ok);
+        };
+        bindingWaiter = complete;
+        postBinding('bind', binding);
+      });
+    }
+
+    function release(requestId, ownerToken) {
+      if (!binding || (requestId && binding.requestId !== requestId)
+        || (ownerToken && ownerToken !== binding.ownerToken)) {
         return;
       }
+      bindingWaiter?.(false);
       postBinding('release', binding);
       binding = null;
     }
@@ -86,14 +121,97 @@
       return response?.ok === true;
     }
 
+    async function knownJournals(requestIds, owners = [], onRetry) {
+      if (typeof runtime?.sendMessage !== 'function') return null;
+      const known = new Set();
+      for (let offset = 0; offset < requestIds.length; offset += 64) {
+        const ids = requestIds.slice(offset, offset + 64);
+        const response = await runtime.sendMessage({ type: 'codex-overleaf/run-journal/known',
+          requestIds: ids, owners: owners.slice(offset, offset + 64) });
+        // An older background cannot rule out browser-only owners.
+        const needsStartupInventory = owners.slice(offset, offset + 64).some(owner => owner.preDispatch === true);
+        if (!response?.ok || !Array.isArray(response.known) || response.ownersChecked !== true
+          || (needsStartupInventory && response.preDispatchChecked !== true)) {
+          if (Number.isFinite(response?.retryAfterMs) && response.retryAfterMs > 0) onRetry?.(response.retryAfterMs);
+          return null;
+        }
+        for (const id of response.known) if (ids.includes(id)) known.add(id);
+      }
+      return known;
+    }
+
+    // Native journals and live browser-only owners are separate evidence. A
+    // missing journal alone cannot establish that another page stopped retrying.
+    async function recoverOrphanedRuns(projectKey, options, result, isCurrent) {
+      const now = Date.now(), candidates = [];
+      let recheckAfterMs = Infinity;
+      const sessions = () => options.listSessions?.() || [];
+      const requestIdFor = (session, record) => record.nativeRequestId || getStartupRequestId(session.id, record.id);
+      const eligible = (session, record) => record.status === 'running' && session.id && record.id
+        && !options.isLiveRun?.(record, session)
+        && (!session.projectId || session.projectId === projectKey)
+        && (!options.accountScopeId || !session.accountScopeId || session.accountScopeId === options.accountScopeId)
+        && (!record.runProjectId || record.runProjectId === projectKey);
+      for (const session of sessions()) {
+        for (const record of session.runs || []) {
+          if (!eligible(session, record)) continue;
+          const started = Date.parse(record.startedAt);
+          if (!Number.isFinite(started)) continue;
+          const remaining = started + (options.orphanGraceMs ?? 60000) - now;
+          if (remaining > 0) { recheckAfterMs = Math.min(recheckAfterMs, remaining); continue; }
+          candidates.push({ session, record, requestId: requestIdFor(session, record) });
+        }
+      }
+      result.recheckAfterMs = Number.isFinite(recheckAfterMs) ? recheckAfterMs : null;
+      if (!candidates.length) return;
+      const known = await knownJournals(candidates.map(item => item.requestId), candidates.map(({ session, record, requestId }) => ({
+        requestId, projectKey, clientRunId: record.id, sessionId: session.id,
+        ...(!record.nativeRequestId ? { preDispatch: true } : {})
+      })), delay => {
+        const key = `${options.accountScopeId || ''}:${projectKey}`;
+        const attempts = inventoryRetries.get(key) || 0;
+        if (attempts >= 3) return;
+        inventoryRetries.set(key, attempts + 1);
+        result.recheckAfterMs = Math.min(result.recheckAfterMs ?? Infinity, delay);
+      }).catch(() => null);
+      if (!known || !isCurrent()) return;
+      inventoryRetries.delete(`${options.accountScopeId || ''}:${projectKey}`);
+      for (const { session, record, requestId } of candidates) {
+        const currentSession = sessions().find(value => value.id === session.id);
+        // State normalization can replace run objects while inventory is pending.
+        if (!currentSession?.runs?.includes(record) || !eligible(currentSession, record)
+          || requestIdFor(currentSession, record) !== requestId || known.has(requestId)) continue;
+        if (!record.runProjectId) record.runProjectId = projectKey;
+        options.normalizeInterruptedRun?.(record);
+        record.status = 'interrupted';
+        record.interruptedDraft = { requestId, threadId: currentSession.codexThreadId || '',
+          turnId: record.codexTurnId || '', lastEventSeq: record.nativeEventSeq || 0, reason: 'extension_reloaded' };
+        options.pauseSessionQueue?.(currentSession, 'page_reload');
+        result.changed = true;
+        result.recoveredRuns.push({ sessionId: currentSession.id, runId: record.id,
+          projectId: projectKey, accountScopeId: options.accountScopeId });
+      }
+    }
+
+    function cancelRecovery() {
+      recoveryGeneration++;
+      clearTimeout(recoveryTimer);
+      recoveryTimer = null;
+    }
+
     async function recoverJournals(options = {}) {
+      cancelRecovery();
+      const generation = recoveryGeneration;
+      const isCurrent = () => !destroyed && generation === recoveryGeneration && options.isCurrent?.() !== false;
       const projectKey = String(options.projectKey || '');
       if (!projectKey) {
         return { changed: false, acknowledgeIds: [] };
       }
       const journals = await listJournals(projectKey).catch(() => []);
+      if (!isCurrent()) return { changed: false, acknowledgeIds: [], recoveredRuns: [] };
       let changed = false;
       const acknowledgeIds = [];
+      const recoveredRuns = [];
       for (const journal of journals) {
         if (!journal?.terminal && !journal?.ownerLost) {
           continue;
@@ -104,7 +222,8 @@
           continue;
         }
         const session = options.findSession?.(journal.sessionId);
-        if (!session) {
+        if (!session || (session.projectId && session.projectId !== projectKey)
+          || (options.accountScopeId && session.accountScopeId && session.accountScopeId !== options.accountScopeId)) {
           continue;
         }
         let record = (session.runs || []).find(run => run.id === journal.clientRunId);
@@ -114,9 +233,19 @@
             session.runs = [...(session.runs || []), record].slice(-20);
           }
         }
-        if (!record) {
+        if (!record || options.isLiveRun?.(record, session)) {
           continue;
         }
+        if (record.runProjectId && record.runProjectId !== projectKey) continue;
+        if (!record.runProjectId) record.runProjectId = projectKey;
+        if (journal.operation === 'compact') {
+          record.operation = 'compact';
+          if (!record.codexThreadId) record.codexThreadId = String(journal.threadId || '');
+          if (session.contextUsage?.threadId === record.codexThreadId
+            && Date.parse(session.contextUsage.observedAt || '') < Date.parse(record.startedAt || '')) {
+            session.contextUsage = null;
+          }
+        }
         if (record.status === 'running') {
           options.normalizeInterruptedRun?.(record);
         }
@@ -136,6 +265,9 @@
             record.nativeEventSeq = sequence;
             continue;
           }
+          // Non-display state (for example context usage) must also recover
+          // from the journal, after the owning thread/turn has been bound.
+          options.onRawEvent?.(raw, { record, session, sequence, journal });
           const recovered = options.mapEvent?.(raw, journal);
           if (recovered) {
             if (recovered.kind === 'stream') {
@@ -163,12 +295,24 @@
         options.pauseSessionQueue?.(session, 'page_reload');
         changed = true;
         acknowledgeIds.push(journal.requestId);
+        recoveredRuns.push({ sessionId: session.id, runId: record.id,
+          projectId: projectKey, accountScopeId: options.accountScopeId });
+      }
+      const result = { changed, acknowledgeIds, recoveredRuns };
+      await recoverOrphanedRuns(projectKey, options, result, isCurrent);
+      if (isCurrent() && result.recheckAfterMs !== null && typeof options.onRecheck === 'function') {
+        recoveryTimer = setTimeout(() => {
+          recoveryTimer = null;
+          if (isCurrent()) Promise.resolve(options.onRecheck()).catch(() => {});
+        }, Math.min(result.recheckAfterMs, 2147483647));
       }
-      return { changed, acknowledgeIds };
+      return result;
     }
 
     function destroy() {
       destroyed = true;
+      cancelRecovery();
+      bindingWaiter?.(false);
       clearTimeout(reconnectTimer);
       reconnectTimer = null;
       try {
@@ -181,8 +325,27 @@
     }
 
     connect();
-    return { acknowledge, bind, destroy, listJournals, recoverJournals, release };
+    return { acknowledge, bind, bindBrowserRun, cancelRecovery, destroy, getOwner: () => binding ? { ...binding } : null,
+      knownJournals, listJournals, recoverJournals, release };
+  }
+
+  function createInterruptedRun(journal, projectKey, statusText) {
+    return { id: journal.clientRunId, task: journal.task || 'interrupted task', mode: journal.mode || 'ask',
+      ...(journal.operation === 'compact' ? { operation: 'compact', codexThreadId: String(journal.threadId || '') } : {}),
+      model: journal.model || '', status: 'interrupted', statusText, runProjectId: projectKey,
+      startedAt: journal.createdAt || new Date().toISOString(), finishedAt: journal.updatedAt || new Date().toISOString(),
+      events: [], attachments: [], undoOperations: [], undoTrackedChanges: [], undoExpectedFiles: [] };
+  }
+
+  function mapRecoveredEvent(raw, journal, options) {
+    const activity = options.mapActivity(raw);
+    if (!activity?.visible || activity.kind === 'technical') return null;
+    return { kind: activity.kind || 'activity', title: options.sanitizeText(activity.title) || 'Event',
+      status: activity.status || 'running', detail: options.sanitizeValue(activity.detail),
+      timestamp: raw.timestamp || journal.updatedAt || new Date().toISOString(),
+      streamKey: options.sanitizeText(activity.streamKey), streamRole: options.sanitizeText(activity.streamRole),
+      appendText: options.sanitizeText(activity.appendText), replaceText: activity.replaceText };
   }
 
-  return { create };
+  return { create, createInterruptedRun, mapRecoveredEvent, getStartupRequestId };
 });

package/extension/src/content/applyResultFormatters.js

@@ -85,7 +85,8 @@
    */
   function normalizeSkippedFailure(item) {
     if (!FailureReasons || !FailureReasons.normalizeFailureReason) return null;
-    const failure = FailureReasons.normalizeFailureReason(item?.result, item?.operation || {}, { locale: getLocale() });
+    const normalize = FailureReasons.normalizeWritebackFailure || FailureReasons.normalizeFailureReason;
+    const failure = normalize(item?.result, item?.operation || {}, { locale: getLocale() });
     if (!failure || !failure.code) return null;
     const localized = FailureReasons.localizeFailureReason
       ? FailureReasons.localizeFailureReason(failure, getLocale(), failureReasonI18nLookup)
@@ -98,7 +99,7 @@
 
   function pickPrimarySkippedFailure(failures) {
     if (!FailureReasons || !FailureReasons.selectPrimaryFailure) return null;
-    return FailureReasons.selectPrimaryFailure(failures);
+    return (FailureReasons.selectPrimaryWritebackFailure || FailureReasons.selectPrimaryFailure)(failures);
   }
 
   function failureReasonI18nLookup(key) {
@@ -134,6 +135,8 @@
     const code = result.code || '';
     const filePath = result.reasonParams?.filePath || operation.path || operation.from || operation.to || '';
     const withDebug = reason => appendApplyResultDebug(reason, result);
+    const catalogReason = formatCatalogFailureReason(result, filePath);
+    if (catalogReason) return withDebug(catalogReason);
     if (key === 'missingBaseFile' || code === 'missing_base_file') {
       const target = filePath || tx('this file', '这个文件');
       return withDebug(tx(
@@ -236,82 +239,52 @@
     return parts.join(', ');
   }
 
+  function formatCatalogFailureReason(result, path) {
+    if (!FailureReasons?.formatFailureReasonForDisplay) return '';
+    // Compact historical settlements can omit canonical validation fields.
+    // Their display is still recoverable without re-normalizing stored facts.
+    const failure = result.failure && typeof result.failure === 'object'
+      ? { ...result.failure, file: result.failure.file || result.file || path }
+      : FailureReasons.normalizeFailureReason(result, { path: result.file || path });
+    const display = FailureReasons.formatFailureReasonForDisplay(failure, getLocale(), failureReasonI18nLookup);
+    return display.localized ? display.message : '';
+  }
+
   function formatBridgeResultReason(result = {}, fallbackPath = '') {
-    const code = result.code || '';
-    const path = result.path || fallbackPath || '';
-    if (getLocale() !== 'en') {
-      return localizeVisibleReason(result.reason || result.error || result.code || tr('unknownReason'));
-    }
-    if (code === 'missing_tracked_changes') {
-      return 'No matching Overleaf tracked-change records were found for this run, so Codex did not undo with text patches.';
-    }
-    if (code === 'tracked_change_file_open_failed') {
-      return path
-        ? `Could not open ${path} to find this run's tracked changes. Handle them manually in the Overleaf review tools.`
-        : 'Could not open the file to find this run\'s tracked changes. Handle them manually in the Overleaf review tools.';
-    }
-    if (code === 'tracked_change_not_found') {
-      return 'No matching tracked changes were found on the Overleaf page for this run.';
-    }
-    if (code === 'tracked_change_reject_control_not_found') {
-      return path
-        ? `Some tracked changes in ${path} remain, but the matching Reject button was not found. Reject them manually in Overleaf.`
-        : 'Some tracked changes remain, but the matching Reject button was not found. Reject them manually in Overleaf.';
-    }
-    if (code === 'tracked_change_reject_not_confirmed') {
-      return 'Codex clicked Reject, but Overleaf still shows this tracked change. Reject it manually in the Overleaf review panel.';
-    }
-    if (code === 'tracked_change_accept_control_not_found') {
-      return path
-        ? `Some tracked changes in ${path} remain, but the matching Accept button was not found. Accept them manually in Overleaf.`
-        : 'Some tracked changes remain, but the matching Accept button was not found. Accept them manually in Overleaf.';
-    }
-    if (code === 'tracked_change_accept_not_confirmed') {
-      return 'Codex clicked Accept, but Overleaf still shows this tracked change. Accept it manually in the Overleaf review panel.';
-    }
-    if (code === 'tracked_change_editor_undo_open_failed') {
-      return path ? `Could not open ${path} for Overleaf native undo.` : 'Could not open the file for Overleaf native undo.';
-    }
-    if (code === 'tracked_change_editor_undo_current_mismatch') {
-      return path
-        ? `${path} no longer matches this run's written content, so Codex did not use Overleaf native undo.`
-        : 'The current content no longer matches this run\'s written content, so Codex did not use Overleaf native undo.';
-    }
-    if (code === 'editor_undo_control_not_found') {
-      return path
-        ? `Could not find Overleaf's editor Undo button to undo this run in ${path}.`
-        : 'Could not find Overleaf\'s editor Undo button to undo this run.';
-    }
-    if (code === 'editor_undo_no_progress') {
-      return path
-        ? `Codex clicked Overleaf Undo, but ${path} did not change.`
-        : 'Codex clicked Overleaf Undo, but the file did not change.';
-    }
-    if (code === 'editor_undo_max_iterations') {
-      return path
-        ? `${path} did not return to its pre-run content after repeated Overleaf native undo steps. Codex stopped to avoid undoing other edits.`
-        : 'The file did not return to its pre-run content after repeated Overleaf native undo steps. Codex stopped to avoid undoing other edits.';
-    }
-    if (code === 'tracked_change_undo_max_iterations') {
-      return path
-        ? `${path} still has tracked changes left. Codex stopped to avoid rejecting unrelated edits.`
-        : 'Tracked changes are still left. Codex stopped to avoid rejecting unrelated edits.';
-    }
-    if (code === 'tracked_change_undo_verify_open_failed') {
-      return path
-        ? `Could not open ${path} after undo to verify content. Reload Overleaf and check manually.`
-        : 'Could not open the file after undo to verify content. Reload Overleaf and check manually.';
-    }
-    if (code === 'tracked_change_undo_verify_failed') {
-      return path
-        ? `${path} did not return to its pre-run content after rejecting tracked changes. Check this run's changes in the Overleaf review panel.`
-        : 'The file did not return to its pre-run content after rejecting tracked changes. Check this run\'s changes in the Overleaf review panel.';
-    }
-    return localizeVisibleReason(result.reason || result.error || result.code || tr('unknownReason'));
+    const path = result.file || result.path || fallbackPath || '';
+    return formatCatalogFailureReason(result, path)
+      || localizeVisibleReason(result.reason || result.error || result.code || tr('unknownReason'));
   }
 
+  const runtimeOwnedReasonPairs = [
+  ['The selected provider no longer exists.', '所选模型服务已不存在。'],
+  ['The selected provider has no usable revision.', '所选模型服务没有可用的配置版本。'],
+  ['The selected provider revision was not captured for this run.', '本轮任务未记录所选模型服务的配置版本。'],
+  ['The selected provider changed after this run was submitted.', '本轮任务提交后，所选模型服务的配置已发生变化。'],
+  ['The captured selection is invalid. Attach it again.', '已记录的选区无效，请重新添加。'],
+  ['Provider revision must be a finite non-negative integer.', '模型服务配置版本必须是有效的非负整数。'],
+  ['A stable matching Overleaf account is required for shared history.', '共享历史需要稳定且匹配的 Overleaf 账号。'],
+  ['The background storage connection was lost.', '后台存储连接已断开。'],
+  ['Shared history is unavailable. Reload the extension and this page.', '共享历史不可用，请重新加载扩展和当前页面。'],
+  ['The shared history lock disconnected.', '共享历史的存储锁连接已断开。'],
+  ['Another page is saving history. Retry after it finishes.', '其他页面正在保存历史，请待保存完成后重试。'],
+  ['The shared history lock was lost before completion.', '操作完成前，共享历史的存储锁已丢失。'],
+  ['A stable account scope is required for durable persistence.', '持久保存需要稳定的账号范围。'],
+  ['A cross-realm browser lock is required for durable persistence.', '持久保存需要能够跨页面协调的浏览器锁。'],
+  ['Shared session storage is unavailable.', '共享会话存储不可用。'],
+  ['Native host request failed.', '本地主机请求失败。'],
+  ['Native host disconnected', '本地主机连接已断开。']
+];
+
   function localizeVisibleReason(reason) {
     const text = String(reason || '').trim();
+    for (const [en, zh] of runtimeOwnedReasonPairs) {
+      if (text === en || text === zh) return tx(en, zh);
+    }
+    const scoped = /^(?:Scoped persistence failed: |限定范围的持久保存失败：)(invalid_commit|stale_view|revision_conflict|queue_revision_conflict|invalid_queue_mutation|queue_claim_conflict)$/.exec(text);
+    if (scoped) return tx(`Scoped persistence failed: ${scoped[1]}`, `限定范围的持久保存失败：${scoped[1]}`);
+    const localized = FailureReasons?.localizeFailureMessage?.(text, getLocale(), failureReasonI18nLookup);
+    if (localized && localized !== text) return localized;
     if (!text || getLocale() !== 'en') {
       return text;
     }

package/extension/src/content/assetTransferBroker.js

@@ -17,11 +17,13 @@
       const deadlineAt = Number.isFinite(input.deadlineAt) && input.deadlineAt > 0 ? input.deadlineAt : null;
       const invalidDeadline = input.deadlineAt !== undefined && deadlineAt === null;
       const expired = () => invalidDeadline || (deadlineAt !== null && now() >= deadlineAt);
-      let textBatch = [], blocked = false;
+      let textBatch = [], blocked = false, cancelled = false, halted = false;
       function skipUndispatched(operations) {
         const result = normalizeTextResult({ ok: false,
-          code: blocked ? 'writeback_tail_not_started' : 'writeback_deadline_exceeded',
-          error: blocked ? 'An earlier writeback is unconfirmed. This operation was not dispatched.'
+          code: cancelled ? 'codex_cancelled' : blocked ? 'writeback_tail_not_started' : 'writeback_deadline_exceeded',
+          error: cancelled ? 'The run was cancelled. This operation was not dispatched.'
+            : halted ? 'An earlier writeback stopped this file plan. This operation was not dispatched.'
+              : blocked ? 'An earlier writeback is unconfirmed. This operation was not dispatched.'
             : invalidDeadline ? 'The writeback deadline is invalid. This operation was not dispatched.'
               : 'The writeback deadline has elapsed. This operation was not dispatched.',
           changedDocument: false }, operations);
@@ -32,26 +34,38 @@
         if (!textBatch.length) return;
         const operations = textBatch;
         textBatch = [];
-        if (blocked || expired()) { skipUndispatched(operations); return; }
-        const response = await callPageBridge('applyOperations', {
+        if (blocked || cancelled || expired()) { skipUndispatched(operations); return; }
+        let response;
+        try { response = await callPageBridge('applyOperations', {
           operations,
           baseFiles: input.baseFiles || [],
           reviewingPolicy: input.reviewingPolicy || '',
+          ...(input.reviewOwnerToken ? { reviewOwnerToken: input.reviewOwnerToken } : {}),
           ...(deadlineAt !== null ? { deadlineAt } : {}),
           requireReviewing: input.requireReviewing === true,
           requireEditing: input.requireEditing === true,
           retryCreates: input.retryCreates === true,
           runProjectId: input.runProjectId || ''
-        });
-        const recovered = response?.code === 'page_bridge_timeout' && response.requestId
+        }); } catch (error) {
+          if (error?.code !== 'codex_cancelled' && error?.cancelled !== true) throw error;
+          cancelled = true;
+          // A later cancelled batch must not discard earlier write/Undo evidence.
+          if (!error.requestId && !results.length) throw error;
+          response = { ok: false, code: 'codex_cancelled', error: error.message,
+            requestId: error.requestId, changedDocument: error.changedDocument !== false };
+        }
+        const recovered = ['page_bridge_timeout', 'codex_cancelled'].includes(response?.code) && response.requestId
           ? await recoverTextReceipt(response, operations, input.runProjectId || '', deadlineAt)
           : response;
         const result = normalizeTextResult(recovered, operations);
+        if (response?.code === 'codex_cancelled' && response.changedDocument === false) result.receiptUnconfirmed = false;
         results.push(result);
-        blocked = result.receiptUnconfirmed === true;
+        cancelled ||= hasCancellation(result);
+        halted ||= result.haltRemainingOperations === true;
+        blocked = halted || result.receiptUnconfirmed === true;
       }
       for (const operation of Array.isArray(input.operations) ? input.operations : []) {
-        if (blocked || expired()) {
+        if (blocked || cancelled || expired()) {
           skipUndispatched([operation]);
           continue;
         }
@@ -60,12 +74,13 @@
           continue;
         }
         await flushTextBatch();
-        if (blocked || expired()) {
+        if (blocked || cancelled || expired()) {
           skipUndispatched([operation]);
           continue;
         }
         const binaryResult = await applyBinaryOperation(operation, input);
         results.push(binaryResult);
+        cancelled ||= hasCancellation(binaryResult);
         blocked = binaryResult.receiptUnconfirmed === true;
       }
       await flushTextBatch();
@@ -84,14 +99,16 @@
           receipt = await callPageBridge('getWritebackReceipt', { requestId: timeout.requestId, runProjectId,
             ...(deadlineAt !== null ? { deadlineAt } : {}) });
         } catch (error) {
-          if (error?.code === 'codex_cancelled' || error?.cancelled === true) throw error;
+          if (error?.code === 'codex_cancelled' || error?.cancelled === true) {
+            recoveryError = error.message || 'Receipt settlement was cancelled.'; break;
+          }
           recoveryError = error?.message || String(error);
           if (!isTransientReceiptFailure(error)) break;
           transportFailed = true;
         }
         if (!transportFailed) {
           if (receipt?.code === 'codex_cancelled' || receipt?.cancelled === true) {
-            throw responseError(receipt, 'codex_cancelled');
+            recoveryError = receipt.error || 'Receipt settlement was cancelled.'; break;
           }
           if (receipt?.ok !== true) {
             recoveryError = receipt?.error?.message || receipt?.error || receipt?.reason
@@ -130,8 +147,9 @@
       const transferId = `asset_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
       const assetRef = operation.assetRef || null;
       const safeOperation = sanitizeOperation(operation);
-      let pageBegun = false, commitAttempted = false;
+      let beginAttempted = false, pageBegun = false, commitAttempted = false;
       try {
+        beginAttempted = true;
         const begin = await callPageBridge('binaryUploadBegin', {
           transferId,
           path: operation.path,
@@ -139,6 +157,7 @@
           sha256: assetRef?.sha256 || operation.sha256 || '',
           mimeType: assetRef?.mimeType || operation.mimeType || 'application/octet-stream',
           overwrite: operation.type === 'overwrite-binary',
+          previousSha256: operation.type === 'overwrite-binary' ? await binaryBaselineHash(operation, input.baseFiles) : undefined,
           runProjectId: input.runProjectId || ''
         });
         if (!begin?.ok) throw responseError(begin, 'binary_upload_begin_failed');
@@ -164,6 +183,8 @@
         if (!committed?.ok) throw responseError(committed, committed?.code || 'binary_upload_failed');
         return { ok: true, applied: [{ operation: safeOperation, result: committed }], skipped: [] };
       } catch (error) {
+        // A commit rejected before dispatch still leaves staged bytes to clean up.
+        if (error.requestDispatched === false) commitAttempted = false;
         let changedDocument = error?.changedDocument === true
           || (commitAttempted && error?.changedDocument !== false);
         if (commitAttempted && changedDocument) {
@@ -176,6 +197,7 @@
               || receipt.runProjectId !== input.runProjectId) break;
             if (receipt.result?.ok === true) {
               return { ok: true, applied: [{ operation: safeOperation, result: receipt.result }], skipped: [],
+                cancelled: error.code === 'codex_cancelled' || error.cancelled === true,
                 receiptRecovery: { transferId, recovered: true, initialError: error.message } };
             }
             if (receipt.state === 'completed' && receipt.changedDocument === false) {
@@ -186,7 +208,8 @@
             await delay(Math.min(500, Math.max(1, deadline - now())));
           } while (now() <= deadline);
         }
-        if (pageBegun && !commitAttempted) {
+        const uncertainBegin = beginAttempted && error.code === 'codex_cancelled' && error.requestDispatched !== false;
+        if (!commitAttempted && (pageBegun || uncertainBegin)) {
           await callPageBridge('binaryUploadAbort', { transferId, runProjectId: input.runProjectId || '' }).catch(() => null);
         }
         const code = error.code || 'binary_upload_failed';
@@ -203,6 +226,9 @@
               ok: false,
               code,
               reason: error.message || 'Binary asset upload failed.',
+              ...(Array.isArray(error.createdDirectories) ? { createdDirectories: error.createdDirectories,
+                folderChanged: error.folderChanged === true, fileUploadAttempted: error.fileUploadAttempted === true,
+                directoryCleanupRequired: error.createdDirectories.length > 0 } : {}),
               changedDocument,
               failure: { code, stage: 'write', file: operation.path, changedDocument }
             }
@@ -249,6 +275,7 @@
     const result = response && typeof response === 'object' ? { ...response } : { ok: false };
     result.applied = Array.isArray(result.applied) ? result.applied : [];
     result.skipped = Array.isArray(result.skipped) ? result.skipped.slice() : [];
+    if (result.skipped.some(entry => entry.result?.receiptUnconfirmed === true)) result.receiptUnconfirmed = true;
     const key = operation => [operation?.type, operation?.path, operation?.to || ''].join('\0');
     const known = new Map();
     for (const entry of [...result.applied, ...result.skipped]) {
@@ -286,6 +313,7 @@
     for (const result of results) {
       merged.applied.push(...(Array.isArray(result?.applied) ? result.applied : []));
       merged.skipped.push(...(Array.isArray(result?.skipped) ? result.skipped : []));
+      if (result?.haltRemainingOperations) merged.haltRemainingOperations = true;
       // Text writeback returns the Reviewing references captured by the page
       // bridge. They are lifecycle data, not diagnostics: dropping them makes
       // recordUndoFromApply classify a successful Track write as legacy Undo,
@@ -322,6 +350,31 @@
     return safe;
   }
 
+  function hasCancellation(result) {
+    return result?.cancelled === true || result?.code === 'codex_cancelled'
+      || result?.skipped?.some(entry => entry.result?.code === 'codex_cancelled');
+  }
+
+  async function binaryBaselineHash(operation, baseFiles = []) {
+    const valid = value => typeof value === 'string' && /^[a-f0-9]{64}$/i.test(value);
+    const base = (baseFiles || []).find(file => file?.path === operation.path);
+    let captured = valid(base?.sha256) ? base.sha256.toLowerCase() : '';
+    if (typeof base?.contentBase64 === 'string' && globalThis.crypto?.subtle && typeof atob === 'function') {
+      const bytes = Uint8Array.from(atob(base.contentBase64), value => value.charCodeAt(0));
+      const hash = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+      const digest = Array.from(new Uint8Array(hash), value => value.toString(16).padStart(2, '0')).join('');
+      if (captured && captured !== digest) throw codedError('binary_asset_baseline_conflict', 'The captured binary baseline has conflicting content and hash.');
+      captured = digest;
+    }
+    if (operation.previousSha256 != null) {
+      if (!valid(operation.previousSha256) || (captured && captured !== operation.previousSha256.toLowerCase())) {
+        throw codedError('binary_asset_baseline_conflict', 'The Native and browser binary baselines differ. Read the project again before replacement.');
+      }
+      return operation.previousSha256.toLowerCase();
+    }
+    return captured;
+  }
+
   function isTransientReceiptFailure(value) {
     const code = value?.code || value?.error?.code;
     if (code) return ['page_bridge_timeout', 'page_bridge_unavailable', 'page_bridge_transport_error',
@@ -337,6 +390,11 @@
       response?.reason || response?.error?.message || response?.error || 'Asset transfer failed.'
     );
     if (typeof response?.changedDocument === 'boolean') error.changedDocument = response.changedDocument;
+    if (Array.isArray(response?.createdDirectories)) {
+      error.createdDirectories = response.createdDirectories;
+      error.folderChanged = response.folderChanged === true;
+      error.fileUploadAttempted = response.fileUploadAttempted === true;
+    }
     error.stage = response?.failure?.stage || 'write';
     return error;
   }